@ory/mastra@1.7.0
Ory Agent Security for Mastra — per-tool authorization, activity auditing, and identity propagation via agent tool-call hooks (or wrapping tool execute). Built on @ory/argus.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package enables an install-time telemetry dependency that reads Git configuration and sends the resulting email domain to a configured remote endpoint. Because install-time collection includes Git-derived user or project information, this is malicious data exfiltration under the review criteria.
Static reason
No blocking static signals were detected.
Trigger
Installing the package, which installs `reova` and runs its postinstall hook.
Impact
The configured endpoint receives an organizational identifier derived from the installer’s Git configuration.
Mechanism
The hook reads the Git user email from `~/.gitconfig`, extracts its domain, and posts install telemetry to `https://telemetry.reo.dev/data`; the root manifest enables this behavior.
Attack narrative
On installation, the enabled `reova` dependency runs its postinstall tracker. It reads the Git user email from `~/.gitconfig`, extracts the domain, and posts it with install telemetry to `telemetry.reo.dev`. This exposes Git-derived organizational information without an install-time request.
AI rationale
The package enables an install-time telemetry dependency that reads Git configuration and sends the resulting email domain to a configured remote endpoint. Because install-time collection includes Git-derived user or project information, this is malicious data exfiltration under the review criteria.
Evidence
package.json.lpm-dependency-evidence-a877686a-8aa3-41c2-b927-f8f34316be29/1/npm-linux/package.json.lpm-dependency-evidence-a877686a-8aa3-41c2-b927-f8f34316be29/1/npm-linux/index.js.lpm-dependency-evidence-a877686a-8aa3-41c2-b927-f8f34316be29/1/npm-linux/src/collector.js.lpm-dependency-evidence-a877686a-8aa3-41c2-b927-f8f34316be29/1/npm-linux/src/sender.js~/.gitconfig
Network endpoints1
telemetry.reo.dev
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package enables `reova` install telemetry and configures `https://telemetry.reo.dev/data`.
- The `reova` dependency runs a postinstall script that starts tracking after a short delay.
- The tracker reads the installer’s Git email from `~/.gitconfig` and includes its domain in the event payload.
- The dependency sends the collected event in an HTTP POST to the configured endpoint.
Evidence against
- The collector sends only the email domain, not the full Git email address.
- The main package has no lifecycle script of its own; the behavior comes from its runtime dependency’s postinstall hook.
Behavioral surface
Source & flagged code
5 flaggedpackage.jsonView file
11"reova": {
"enabled": true,
"endpoint": "https://telemetry.reo.dev/data"
},
"main
High
Ai Review Evidence
The package enables `reova` install telemetry and configures `https://telemetry.reo.dev/data`.
package.jsonView on unpkg · L11.lpm-dependency-evidence-a877686a-8aa3-41c2-b927-f8f34316be29/1/npm-linux/index.jsView file
17const trackingPromise = delay(START_DELAY_MS)
.then(() => new Tracker().track())
.catch(() => {
// Never surface errors to the install.
});
Promise.r
High
Suspicious Lifecycle Evidence
The `reova` dependency runs a postinstall script that starts tracking after a short delay.
.lpm-dependency-evidence-a877686a-8aa3-41c2-b927-f8f34316be29/1/npm-linux/index.jsView on unpkg · L17Findings
5 High1 Low
HighAi Review Evidencepackage.json
HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-a877686a-8aa3-41c2-b927-f8f34316be29/1/npm-linux/index.js
HighAi Review Evidence.lpm-dependency-evidence-a877686a-8aa3-41c2-b927-f8f34316be29/1/npm-linux/src/collector.js
HighAi Review Evidence.lpm-dependency-evidence-a877686a-8aa3-41c2-b927-f8f34316be29/1/npm-linux/src/collector.js
HighSuspicious Dependency Evidence.lpm-dependency-evidence-a877686a-8aa3-41c2-b927-f8f34316be29/1/npm-linux/src/sender.js
LowScripts Present
Affected versions and remediation
This report applies to @ory/mastra@1.7.0.
See all versions of @ory/mastra for other recorded verdicts.
- Avoid installing @ory/mastra@1.7.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.